HPlum78

Yep was always going to go this way should have called the thread remain or leave.... :-p

https://docs.microsoft.com/en-us/exchange/troubleshoot/mailbox-configuration/dns-query-failed Is the MS take on this....

@localzuk I understand the points you have made and indeed in my initial post note the limitations that you yourself outlined, Just trying to make people think of things in a different way. I know that school IT is a strained environment when it comes to budgets and staffing and being able to afford to have out and out development roles in the IT departs of schools is almost unheard of. I also have noted on this forum more than once that most in IT departments in schools will go above and beyond the call to deliver IT services. Do not get my wrong I am opposed to the "Open Source can do everything, you're wrong if you pay for stuff" mantra there is a place for all at the table in my mind as well as in house development. The issues with IT in schools is a problematic one for me (I have a unique view of this as an IT Network Manager of years gone by and having my partners view of budgets and feelings from an FD of a MAT perspective) I know that a number of schools and MATS are outsourcing as much of the support infrastructure as possible from cleaning to IT Services. The drivers for this are more than just a monetary concern by the way, there is an overarching feeling in the sector that the staff in schools (SLT) need to concentrate on educating and having all the support infrastructure/ staff to manage takes them away from doing just that (not a sentiment I share by the way). I also know that no one has said not to use open source but because of the position IT departments are put in open source is discounted. All these things are part of the same machine (staff, skills, budgets, time, flavour of paid/ open source or in house dev.......) and by the very nature of how IT is viewed in schools is clearly having an impact on the decisions being made when designing solutions. That is clear from the comments on here, that said some of the issues are self-inflicted.

PoweShell is open source and MS are now one of the largest open source software houses around now. If your IT department is only there to support the IT systems that are put in place and in turn that is underpinned by paid for software/ support contracts in my mind that is very close to being outsourced IT. How is IT approached by those around here? Are you very much IT departments that make the decisions from cradle to grave? or do you have a partner approach? (one where if the FD wants to solve an issue they are the project sponsor and as an IT department they engage you for a solution) The reason I ask is that depending on how you work means that you either consume IT as an IT department or you develop as an IT department the latter in essence give you more options in your architecture approach and opens the door for OS/ Paid or in house development of solutions. I have been around long enough to know that most will fall into the former, but as you become bigger in size the worry of skills walking out the door has to be accepted, by not offering a route for your IT staff to develop solutions and skills will mean that they will walk anyhow. Do not get me wrong there will always be a need for the click next admin but I fear that those days and posts are going to become sparse in the coming years.

Ah web browsers so last week :-p

I have seen some software vendors be no more than 'Fred' in the education sector and I will sit and develop a solution to solve a perticular problem. The thing is where I am they have got the right balance between front line support and development staff. Individual schools don't have this in my experience. More support staff who are essentially there to keep the lights on, MATs on the other hand should be in a better position and should surly be aiming to get a mix of skills that allow someone to develop/ support bespoke solutions. That's not to say that you should not take payed for solutions nor turn away from a perfectly viable free offering but some of the decisions are down to as already noted staffing, time and skill sets. Also risk is a part of the decision making process when confronted with a like for like free/ payed solution as @localzuk you sort of touch upon in your initial post. One last thing that education institutions have to take into accout when making a decision around software that is essentially going to be used by students is what are they likely going to be put in front of when they move on to FE/ HE or the work place.

Now you can have guests in teams is this not an option for this?

So if I aint lost you along the way here, the next part is to actually do some damage! the following function creates an event in a calendar in O365:- You will need to add the required permission to the app you created earlier to Calendars.ReadWrite the MS documentation is here https://docs.microsoft.com/en-us/graph/api/calendar-post-events?view=graph-rest-1.0&tabs=http function Add-EXOLAppointment { [CmdletBinding()] Param( [Parameter(Position=0,Mandatory=$true,ValueFromPipeline=$true)][string]$Body, [Parameter(Position=1,Mandatory=$true,ValueFromPipeline=$true)][string]$Subject, [Parameter(Position=2,Mandatory=$true,ValueFromPipeline=$true)][datetime]$StartDate, [Parameter(Position=3,Mandatory=$true,ValueFromPipeline=$true)][datetime]$EndDate, [Parameter(Position=4,Mandatory=$true,ValueFromPipeline=$true)][string]$Location, [Parameter(Position=5,Mandatory=$true,ValueFromPipeline=$true)][string]$UPN, [Parameter(Position=6,Mandatory=$true,ValueFromPipeline=$true)]$Token ) ### Verbose output of parameters passed to function Write-Verbose $PSBoundParameters try { $mybody = [pscustomobject]@{ contentType = "HTML" content = $body } $mystart = [pscustomobject]@{ dateTime = $StartDate.ToString("yyyy-MM-ddTHH:mm:ss") timeZone = "Greenwich Standard Time" } $myend = [pscustomobject]@{ dateTime = $EndDate.ToString("yyyy-MM-ddTHH:mm:ss") timeZone = "Greenwich Standard Time" } $mylocation = [pscustomobject]@{ displayname = $location } $JSON = [pscustomobject]@{ Subject = $Subject body = $mybody start = $myStart end = $myEnd location = $myLocation showAs = 'busy' } $RequestJSON = $JSON | ConvertTo-Json $headers = New-Object "System.Collections.Generic.Dictionary[[string],[string]]" $headers.Add("Content-Type", 'application/json') $headers.Add("Authorization", 'Bearer ' + $($token)) $headers.Add("Prefer", 'outlook.timezone="Greenwich Standard Time"') if ($session){ Write-Output "Creating New Appointment for user: $UPN" $result = Invoke-RestMethod -SessionVariable $session -Headers $headers -Uri "https://graph.microsoft.com/v1.0/users/$UPN/calendar/events" -Body $RequestJSON -UseBasicParsing -Method Post } else{ Write-Output "Existing session not found" } if ($result.id){ return $result.id } else{ return $false } } catch { #### Main catch for other unhandled errors in function Write-Output "Unexpected error in function: $($MyInvocation.MyCommand) " -errorrecord $_ } } So this function takes a number of inputs to create an event in a calendar via a GRAPH call this is essentially what can be used to take you CSV file data and create the events based on that data. The $UPN parameter is the account that you are going to create the event for.

$GPOGUID = '*{D16A8C8A-0C59-4371-8640-E99E8CCFB726}*' Get-ADOrganizationalUnit -LDAPFilter "(gPLink=$GPOGUID)" in fact $GPOGUID = '{D16A8C8A-0C59-4371-8640-E99E8CCFB726}' Get-ADOrganizationalUnit -LDAPFilter "(gPLink=*$($GPOGUID)*)"

Yep every users needs their own cert, and they would need to manage that as well... Its very user intensive....

If you are still with me then the next part will get the events from a calendar:- We are going to use the function above and get a token from Azure so that we can start to read events from a calendar using the GRAPH api. ### Get a token from Azure [color=#333333]$AzToken = Get-AZGraphToken -ClientId be68bfbd-4012-b52c-b56b-d1e421c0bc62 -ClientSecret oM3LA449hap78CK?A_dpU[m@7nb-AXDH4 -TenantDomain 'plumtreeservices.onmicrosoft.com' ### Setting up the session object [/color][color=#333333]$session = [/color]New-Object Microsoft.PowerShell.Commands.WebRequestSession ### setting the header object and assigning it the correct parameters and token $headers = New-Object "System.Collections.Generic.Dictionary[[string],[string]]" $headers.Add("Content-Type", 'application/json') $headers.Add("Authorization", 'Bearer ' + $($AzToken.access_token) ) $headers.Add("Prefer", 'outlook.timezone="Greenwich Standard Time"') ### the upn of the user that we are going to get the events of $upn = '[email protected]' ### invoke the call Invoke-RestMethod -Method Get -SessionVariable $session -Headers $headers -Uri "https://graph.microsoft.com/v1.0/users/$UPN/calendar/events?$select=subject,body,bodyPreview,organizer,attendees,start,end,location" You should start seeing events streaming up the PowerShell windows (make sure that you have some events in the calendar in the future!)

So the idea is that you can run the above function in PowerShell:- Get-AZGraphToken -ClientId be68bfbd-4012-b52c-b56b-d1e421c0bc62 -ClientSecret oM3LA449hap78CK?A_dpU[m@7nb-AXDH4 -TenantDomain 'plumtreeservices.onmicrosoft.com' You should get what is shown in the attached screen grab. I would recomend that you put that in a $Var:- $AzToken = Get-AZGraphToken -ClientId be68bfbd-4012-b52c-b56b-d1e421c0bc62 -ClientSecret oM3LA449hap78CK?A_dpU[m@7nb-AXDH4 -TenantDomain 'plumtreeservices.onmicrosoft.com'

function Get-AZGraphToken{ [CmdletBinding()] Param( [Parameter(Position=0,Mandatory=$true,ValueFromPipeline=$true)]$ClientID, [Parameter(Position=1,Mandatory=$true,ValueFromPipeline=$true)]$ClientSecret, [Parameter(Position=2,Mandatory=$false,ValueFromPipeline=$true)]$TenantDomain ) ### Verbose output of paramters passed to function Write-Verbose $PSBoundParameters $LoginURL = 'https://login.microsoft.com' $Resource = 'https://graph.microsoft.com' try { $Body = @{grant_type="client_credentials";resource=$Resource;client_id=$ClientID;client_secret=$ClientSecret} $OAuth = Invoke-RestMethod -Method Post -Uri $LoginURL/$TenantDomain/oauth2/token?api-version=1.0 -Body $Body return $OAuth } catch { #### Main catch for other unhandled errors in function Write-output "Unexpected error in function: $($MyInvocation.MyCommand) " -errorrecord $_ } } I will help shift this on a little and post the PowerShell code to get a token from your tenant. You will need to have created an app within Azure and create the secret and assign the API - Microsoft Graph - Calendars.Read and User.Read permissions initially. https://docs.microsoft.com/en-us/graph/auth-v2-service?view=graph-rest-1.0 The above will help with that, if required I can help with this by posting some step by steps if required.

https://docs.microsoft.com/en-us/graph/api/calendar-post-events?view=graph-rest-1.0&tabs=http So the above is a link to the graph API for events in a calander. I will share some code later but would like someone to have a crack at doing this. I use PowerShell I will give you a starter for 10 and say look at getting a session token..... The Graph API is a more refined way to do this as you do not have to smash holes in your environments by giving out Exchange impersonation permissions you can be way more fine grained. In the first instance look at creating the events then we can look at how to manage updates but for that we need to get back the GUID for the events we create. Also the graph API is throttled at just 10000 requests per min rather than the 50 requests per min using the EWS rest API... Sorry will just add this, if you have a CSV with the data of your events in then with some PowerShell (or other language) covert that in to JSON no need for this convert to .ics and blah... (also .ics files are a little static and calendars generally dont stay that static when they meet the meat cylinders of us humans!) if you spend a bit of time understanding this there is no end to the possibilities that this unlocks and you will soon be writing out your staff and student events in to their calendars from what ever MIS system you use. And the cost to you is applying yourself to a little learning.

Number of users is only part of the equation when talking RAM in a DC. The DIT files can grow in size for a number of reasons and you should be sizing based on that as well as number of users aoung other things.

I am all for Write-Output as you can actually do something with the output! Unless you are all running your scripts interactively? Also a try catch block so you can do some error trapping and propper logging would be good as well.

How are you managing the release of the updates?

So make sure that your smtp server cannot accept message on behalf of other domains (domains you don't own in general) In fact rather than me covering this look at the following:- http://Https://www.xeams.com/smtprelay.htm

The way to determine that would be to look at a message header. Would need to see what it's doing to the envelope and the likes.

Have you enabled guest access for teams? Could be a way to solve this. That's my initial thought could be barking up the wrong tree.

So post Skylake it's got to be UEFI GPT, it's not my thing these days so ain't kept up with what's what (I just get delivered my platform) so what that looks on a Dell I don't know.

What is the partition type MBR?

You can use mxtoolbox or dmarcanalyzer.com to help generate dmarc, dkim and spf records. Take a look at they will help unpick the records you need and how they should look.

The issue is that a compromised account would be used to send mail out via SMTP by the shed load so MS have protection in place. Rightly so as it would soon get their IP's blacklisted if they did nothing about spurious traffic.

How much SMTP traffic you submitting? What's your architecture?